← back to Domain Sniper

brand-typo-watcher: docstring guards future-me against suppressing BARE_PUNYCODE

c7ac9f6f4a8f400374a9e049024053e4d536b407 · 2026-05-12 18:59:06 -0700 · steve

The NOISE_PATTERNS how-to-extend block previously said 'when minute
summary shows persistent puny= or hits=' — but puny= is intentional
homoglyph audit-trail logging, not a false positive. Suppressing
those patterns would silence the actual security signal the watcher
is built to surface.

Now the guidance is explicit: only add SUBSTRING/TYPO false positives;
BARE_PUNYCODE rows must stay. Adds 'use npm run audit:noise' to the
workflow so the new candidate-filtering tool is the canonical source.

Also recorded 5.37h slice 4-5 RECHECK#3: 0/10. Cumulative 0/190
across 20 datapoints.

Files touched

• M brand-typo-watcher.js

Diff

commit c7ac9f6f4a8f400374a9e049024053e4d536b407
Author: steve <steve@designerwallcoverings.com>
Date:   Tue May 12 18:59:06 2026 -0700

    brand-typo-watcher: docstring guards future-me against suppressing BARE_PUNYCODE
    
    The NOISE_PATTERNS how-to-extend block previously said 'when minute
    summary shows persistent puny= or hits=' — but puny= is intentional
    homoglyph audit-trail logging, not a false positive. Suppressing
    those patterns would silence the actual security signal the watcher
    is built to surface.
    
    Now the guidance is explicit: only add SUBSTRING/TYPO false positives;
    BARE_PUNYCODE rows must stay. Adds 'use npm run audit:noise' to the
    workflow so the new candidate-filtering tool is the canonical source.
    
    Also recorded 5.37h slice 4-5 RECHECK#3: 0/10. Cumulative 0/190
    across 20 datapoints.
---
 brand-typo-watcher.js | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/brand-typo-watcher.js b/brand-typo-watcher.js
index 4054fac..a5e0ab8 100644
--- a/brand-typo-watcher.js
+++ b/brand-typo-watcher.js
@@ -35,12 +35,19 @@ const NOTIFY = process.env.NOTIFY !== '0';
 // These are catalogued false positives from real CT firehose runs; add new ones here as they
 // emerge to keep the signal-to-noise ratio honest. Audit at: data/brand-typo-hits.jsonl.
 //
-// How to extend: when minute summary shows persistent puny= or hits= against an obvious
-// non-squat (legit service, internal infra, third-party app):
-//   1. Grep brand-typo-hits.jsonl by domain suffix to confirm volume / consistency.
-//   2. Add a regex below that anchors on the right-most labels (^... .legit.com$).
-//   3. Bounce the watcher: kill <PID> && nohup node brand-typo-watcher.js >> logs/brand-typo.log 2>&1 &
-//   4. Confirm noise= counter climbs and puny=/hits= stays clean.
+// CAUTION: only add patterns that produce SUBSTRING or TYPO false positives. Do NOT add
+// suffixes that only appear via BARE_PUNYCODE rows — those are intentional homoglyph-
+// monitoring audit-trail logging, not false positives. Use `npm run audit:noise` to
+// distinguish: it now flags only real brand-match suffixes (≥3 hits) as candidates.
+//
+// How to extend: when minute summary shows persistent hits= against an obvious non-squat
+// (legit service, internal infra, third-party app whose stem collides with a brand by
+// Levenshtein-2):
+//   1. `npm run audit:noise` — look at the "candidate NOISE_PATTERNS to add" block.
+//   2. Grep brand-typo-hits.jsonl by domain suffix; verify matchType is SUBSTRING or TYPO.
+//   3. Add a regex below that anchors on the right-most labels (\.legit\.com$).
+//   4. Bounce the watcher: kill <PID> && nohup node brand-typo-watcher.js >> logs/brand-typo.log 2>&1 &
+//   5. Confirm noise= counter climbs and hits= stays clean.
 const NOISE_PATTERNS = [
   /\.haplorrhini\.com$/i,         // Let's Encrypt internal HTTP-01 challenge subdomains
   /\.beutl\.in$/i,                // Beutl video-editor app — Levenshtein-2 collision with "butlr"

← 1070e77 audit-noise: distinguish brand-match hits from BARE_PUNYCODE  ·  back to Domain Sniper  ·  spotcheck: extract reusable DoH-only honeypot sampler + 5.46 6cf9621 →